Core Text has code paths that call into CGFontCreateFontsWithPath() directly, bypassing CG’s font database. This can and does (in TOT WebKit, for example) result in multiple distinct CGFont objects being created for the exact same font. See <rdar://problem/9089228>for details. Every time we get a new and distinct CGFontRef, we create a new FontCache entry and abandon the old one.
The cache fails to find the earlier entry due to FontPlatformData::platformIsEqual() in FontPlatformDataCocoa.mm comparing the saved m_cfFont.